tower-http's improper validation of Windows paths could lead to directory traversal attack
Moderate severity
GitHub Reviewed
Published
Jun 17, 2022
to the GitHub Advisory Database
•
Updated Jun 13, 2023
Description
Published to the GitHub Advisory Database
Jun 17, 2022
Reviewed
Jun 17, 2022
Last updated
Jun 13, 2023
tower_http::services::fs::ServeDirdidn't correctly validate Windows paths meaning paths like/foo/bar/c:/windows/web/screen/img101.pngwould be allowed and respond with the contents ofc:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem. This only impacts Windows. Linux and other unix likes are not impacted by this.References